Security Research Suggests Linux Has Fewer Flaws

c|Net ^ | 12/13/2004 | Robert Lemos

[Prime Choice]

The Linux operating system has many times fewer bugs than typical commercial software, according to an upcoming report.

The conclusion is the result of a four-year research project conducted by code-analysis company Coverity, which plans to release its report on Tuesday. The project found 985 bugs in the 5.7 million lines of code that make up the latest version of the Linux core operating system, or kernel. A typical commercial program of similar size usually has more than 5,000 flaws or defects, according to data from Carnegie Mellon University.

"Linux is a very good system in terms of bug density," said Seth Hallem, CEO of Coverity, a San Francisco company that makes flaw-detection tools for software written in C and C++ programming languages.

Code-analysis tools typically use software-design principles to analyze a program's source code and flag any possible problems. Microsoft already uses such tools widely in its internal development, and many compilers are starting to include rudimentary versions of the programs as well. The tools are also being used to tame the wild coding prevalent around the Web.

Though Coverity does not have any data about the relative frequency of flaws in Microsoft's Windows operating system, the latest data will likely feed the debate between the various proponents of Linux, Mac OS X and Windows over which operating system is more secure.

A recent report, for example, found that Red Hat Linux had fewer critical flaws than Microsoft Windows. Another research paper, conducted by Forrester Research and sponsored by Microsoft, unsurprisingly favored Windows.

Coverity has not analyzed the source code to Microsoft Windows because the company does not have access to the source code, Hallem said. Apple Computer's Mac OS X has a great deal of proprietary programming, but the core of the operating system is based on BSD, an open-source operating system similar to Linux.

Hallem stressed that the research on Linux--specifically, version 2.6 of the kernel--indicated that the open-source development process produced a secure operating system.

"There are other public reports that describe the bug density of Windows, and I would say that Linux is comparable or better than Windows," he said.

A representative of Microsoft could not immediately comment on the Coverity study.

The research suggests that the Linux kernel scored better than run-of-the-mill commercial code. Proprietary software, in general, has 1 to 7 flaws per thousand lines of code, according to an April report from the National Cybersecurity Partnership's Working Group on the Software Lifecycle, which cited an analysis of development methods by the Software Engineering Institute at Carnegie Mellon University.

For a 5.7 million-line program, such as version 2.6 of the Linux kernel, that roughly adds up to between 5,700 and 40,000 flaws.

Microsoft uses analysis tools similar to those in Coverity's study to vet its Windows code. One tool, known as PREfast, runs on each developer's workstation to check code for simple problems. The other tool, PREfix, is run every night on the Windows source code to catch more complex issues.

Coverity's Hallem acknowledged that by running similar tools to its own, Microsoft likely had reduced the number of defects in Windows.

Coverity plans to provide regular bug analysis reports on Linux and make a summary of the results available to the Linux developer community.

[Prime Choice]

Friends don't let friends use Micro$loth.

See also:
TCO study: Linux wins again
http://www.freerepublic.com/focus/f-news/1300541/posts

[fire_eye]

When I first started using Unix in 1980, I didn't think an OS could get any worse.

But somehow, Gates pulled it off - and in the extreme.

This year, since I'm unemployed, I finally managed to get Linux up and now I'm on my way out of Gatesland. I *never* before thought anything could make me GLAD to get my hands back on a Unix system - but Gates managed to pull THAT off too - and in even *greater* extreme.

(Actually, Unix has matured to the point where I've made my peace with it... I almost don't notice the code and documentation that's obviously written by potheads from Berserkeley, any more...)

[fire_eye]

I should probably add... the Billsoft crowd KNOWs Linux is more stable than all their NT-based crap - if anyone can find a URL for the infamous "Halloween Memo", they even admit it in there. They issued a directive to their Marketing attack droids - "Under No Circumsatances Lose To Linux" - they're scared to death of it.

Fortunately for them, it's still not "plug-and-pray" enough to replace the Windoze office environment... that'll be a while, yet...

[Bosco]

I use WinXP and linux every day in a software development environment and I can vouch for the fewer problems and greater stability of the linux system.

My latest problem with the XP box was an unsuccessful (3x) installs of service pack 2 due to enterprise virus services locking the registry file without raising an error. The linux system is RedHat 9 with KDE 3.3 and I torture the heck out of it and it still runs like a champ.

Merry Christmas!

[beaversmom]

Ping

[fire_eye]

I never upgraded from Win98 but my Win98 installation has *never* been stable - sometimes it won't boot at all, and of course it crashes whenever it feels like it.

My Debian Linux has NEVER failed to boot and has NEVER crashed (well, okay, it crashed *once* when I did something REALLY stupid...).

I still need some of the Gatesware apps though, so my Holy Grail for the near future is to imprison Win98 within VMware where it is under total absolute autocratic control of Linux, where maybe my system will be safe from it...

[Bosco]

I use VMware with a linux guest on a regular basis, but not with linux as the host. If it's just a few Win apps you can't live without, take a look at Crossover Office - a commercial WINE application. Works pretty well with the main MS apps from what I saw and used with the demo install I used.

[spinestein]

I use win 98 se, win XP pro, and Mandrake Linux 8.1 all on a weekly basis. They are each on their own computer and each for a specific purpose that I have gotten used to through trial and error and that nobody else ever touches. I never have problems with any of the OS's because I don't screw with them or do anything unexpected.

This is probably not realistic for most users because I also don't have a habit of installing and uninstalling applications or downloading anything online.

Interesting note: My boss has a 486 PC with DOS that he has used continuously since 1994 to run his manufacturing business on (invoicing, shipping, inventory, contacts, payroll, accounting etc...) and it has never crashed. He just turns it on in the morning, crunches some numbers, hits save, prints, and turns it off at night.

[RebelTex]

You neglected to post obligatory pics.

                   

;^D

[fire_eye]

No, it's a ton of third-party stuff... PhartoShop, Nikon camera software, PageMaker, ScreamWeaver, Schlockwave Trash, this, that, the other, that's not available for Linux yet.
I'm just going to have to bring up VMware and the whole
enchilada...

[goldstategop]

The new Xandros 3.0 comes with a built-in GUI firewall wizard - a first for Linux and also a GUI VPN wizard to allow easy network connection - a first for Linux. There aren't many viruses, worms and malware written for Linux based operating systems as they're not in widespread desktop use yet. But Linux is no longer for geeks and hobbyists. Its as easy to set up and run as Windows today.

[goldstategop]

There's Open Office Org - not as polished as Windows but good enough for home and simple business use. And its FREE. If one needs an office suite with a professional database, there's Star Office. And both are compatible with Microsoft Office file formats.

[goldstategop]

I replaced Windows 98 with Xandros 2.5 on an old laptop. Its extremely stable and there's no need to worry about being safe on the 'Net. While you need a hardware-controller based modem to connect with dial-up online, that and all distros will detect and set up a broadband conection.

[goldstategop]

Pictures? Have you tried The Gimp? Its said to rival Adobe Photoshop.

[Prime Choice]

You neglected to post obligatory pics.

Yikes!

[RebelTex]

ROTFLMAO

Very good!

You win the prize.
:^D

[fire_eye]

Yeah, DOS is about as good as it gets for stability in a Gatesware OS...

I need more interoperability between the OSs than I can get by just having them running on separate computers (I already have that... and they're all networked together... but it just doesn't cut it the way having a VMware environment would, *if* it works the way it's supposed to).

[fire_eye]

I've got it but haven't loaded it... thing is, if I try to displace PhartoShop with it, the first time it won't do something that PhartoShop will or won't read something that PhartoShop wrote or etc. ad infinitum, my wife will open her desk drawer and get out the (razor-sharp) Philippine Daga that she keeps in there and give me That Look...

[fire_eye]

I was able to get KDE's "KPPP" dialer to connect my dialup OK, with a minimal (but non-zero) amount of hacking... I haven't tried to get any sort of automated connect protocol like "diald" or whatever working -

[ShadowAce]

Linux Ping